supporting IdP-initiated SSO only

[Ian Young]

On 16 Mar 2013, at 18:22, Tom Scavo <trscavo at gmail.com> wrote:

> Well, as you know, the moment you add an IDPSSODescriptor with a
> SingleSignOnService endpoint to a federation metadata aggregate, that
> IdP will appear on discovery interfaces and SPs can/will start sending
> AuthnRequests to it. OTOH, if the IDPSSODescriptor contained no
> endpoints, SPs would not be able to send any AuthnRequests, but IdPs
> would still be able to push unsolicited responses. This would give an
> IdP a way to ease itself into a federation.

It sounds like your use case could be described as wanting to make the new IdP less discoverable.  In the UKf, we have a mechanism for that which involves a custom element (essentially an entity attribute, but invented before that concept was).  Our CDS and some (but by no means all) SPs that do their own discovery exclude such IdPs by default.  Dick Visser mentioned his implementation of this for SSP recently, for example.  Our CDS has a facility to "search across all sites" to make the otherwise hidden IdPs visible again.

>>> I'm not sure how to answer that
>>> question. Seems the only option is to define a custom RoleDescriptor.
>> 
>> If you define a custom RoleDescriptor, no SP will understand it.
> 
> That's true, and that's why I'm raising this question here. I didn't
> realize until today that this use case (i.e., a Shib IdP that supports
> SAML2 IdP-initiated SSO only) can not be encoded in a standard entity
> descriptor. So the only way this will happen is if the Shib SP and the
> Shib DS both support the use case.

I'd think it would be extremely unlikely that approaching this use case by defining a new role descriptor would be practical.  Not only would the Shibboleth CDS, EDS and SP need to understand such a role descriptor, but every other SP implementation would need to understand it as well, *and* everyone in the world would have to deploy updated software, or such an IdP would just not be visible to them at all.  I think that's a non-starter, I'm afraid.

Some sort of "I should be less discoverable" extension to the existing metadata would still be interoperable with the existing standard and deployments.  Of course only deployments that understood the extension (probably an entity attribute) would be able to honour the IdP's desire to be less discoverable, but that seems better to me than having everyone else not being able to interoperate with it at all.

	-- Ian



-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 4813 bytes
Desc: not available
Url : http://shibboleth.net/pipermail/dev/attachments/20130316/5fb4a400/attachment.bin